CVE-2026-101809 & 63 More Critical Oracle CVEs: Defending Against Network-Exploitable CVSS 10.0 Flaws in the April 2026 Oracle CPU

---
title: Oracle or WebLogic Server Process Spawning Shell or Script Interpreter
id: 6f3a1b92-4c7d-4e58-9a21-8b5c2d7e0f41
status: experimental
description: Detects Oracle Database (oracle.exe), TNS Listener (tnslsnr), or WebLogic Java processes spawning command shells or script interpreters — a hallmark of post-exploitation following RCE against Oracle services such as CVE-2026-101809.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101809
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/17
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\oracle.exe'
      - '\tnslsnr.exe'
      - '\java.exe'
      - '\javaw.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
  filter_weblogic_path:
    ParentCommandLine|contains:
      - 'weblogic.Server'
      - 'startWebLogic'
  condition: selection_parent and selection_child and not filter_weblogic_path
falsepositives:
  - Oracle Enterprise Manager jobs invoking host commands (rare; baseline and whitelist by command line)
  - Legitimate WebLogic admin scripts (typically launch via startWebLogic.cmd, filtered above)
level: critical
---
title: Linux Oracle User Spawning Interactive Shell or Download Utility
id: 9d2e7c44-1a8b-4f63-b5d0-3c9e6a1f78b2
status: experimental
description: Detects the oracle service account or tnslsnr spawning shells, downloaders, or network utilities on Linux — consistent with exploitation of network-facing Oracle vulnerabilities such as the April 2026 critical CPU batch.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101809
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/17
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/tnslsnr'
      - '/oracle'
      - '/java'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Oracle installer/patching workflows (runInstaller, opatch) — correlate with maintenance windows
  - Health-check scripts running under oracle user (baseline known scripts by command line)
level: critical
---
title: Outbound Network Connection from Oracle Database or Listener Process
id: 4b8f6e10-2d5a-4c91-87e3-f1a0c6d4b9e7
status: experimental
description: Detects Oracle Database or TNS Listener processes initiating outbound connections to non-database ports — indicative of reverse shell or C2 activity following exploitation of network-vector Oracle CVEs.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101809
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/17
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\oracle.exe'
      - '\tnslsnr.exe'
  filter_known:
    DestinationPort:
      - 1521
      - 1522
      - 2483
      - 2484
      - 443
  condition: selection and not filter_known
falsepositives:
  - Oracle Enterprise Manager agent communication (restrict to OEM hosts if needed)
  - Database links to external hosts (baseline by destination)
level: high

// Hunt 1: Oracle/WebLogic server processes spawning shells or LOLBins (Windows)
let OracleParents = dynamic(["oracle.exe", "tnslsnr.exe", "java.exe", "javaw.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (OracleParents)
| where FileName in~ (SuspiciousChildren)
| where InitiatingProcessCommandLine !has "startWebLogic"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessRemoteIP = InitiatingProcessRemoteUrl
| order by TimeGenerated desc;

// Hunt 2: Linux oracle/tnslsnr spawning shells or downloaders (Syslog/CEF ingestion)
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName in~ ("tnslsnr", "oracle", "java")
   or SyslogMessage has_any ("tnslsnr", "/oracle/")
| where SyslogMessage has_any ("/bin/bash", "/bin/sh", "curl ", "wget ", "nc ", "ncat", "python", "base64 -d")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc;

// Hunt 3: Anomalous inbound connections to Oracle TNS/WebLogic ports from external or unusual internal sources
CommonSecurityLog
| where TimeGenerated > ago(3d)
| where DestinationPort in (1521, 1522, 7001, 7002, 8001)
| where SourceIP !startswith "10." and SourceIP !startswith "192.168." and SourceIP !startswith "172.16."
| summarize ConnectionCount = count(), DistinctSources = dcount(SourceIP) by DestinationIP, DestinationPort, DeviceAction
| order by ConnectionCount desc;

-- Hunt: Oracle/WebLogic post-exploitation artifacts
-- Identifies shells spawned by Oracle processes, suspicious files in writable paths,
-- and unusual network connections from Oracle service processes.

SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (
    (Exe =~ '(?i)(oracle|tnslsnr|java|javaw)' AND Ppid != 0)
)
AND (
    CommandLine =~ '(?i)(cmd\.exe|powershell|pwsh|/bin/sh|/bin/bash|curl|wget|ncat|netcat|base64)'
    OR Name =~ '(?i)^(cmd|powershell|pwsh|sh|bash)$'
)

-- Secondary: enumerate current connections from Oracle processes
SELECT Pid, Name, Family, Type, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Name =~ '(?i)(oracle|tnslsnr|java)'
  AND RemotePort NOT IN (1521, 1522, 7001, 7002)
  AND RemoteAddr != ''
  AND RemoteAddr != '127.0.0.1'
  AND RemoteAddr != '::1'

-- Tertiary: recent executable drops in temp and Oracle-writable directories
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
    'C:\\Windows\\Temp\\*.exe',
    'C:\\Windows\\Temp\\*.dll',
    'C:\\Users\\*\\AppData\\Local\\Temp\\*.exe',
    '/tmp/*.elf',
    '/tmp/*.sh',
    '/var/tmp/*',
    '/dev/shm/*'
])
WHERE Mtime > now() - 604800
ORDER BY Mtime DESC

#!/bin/bash
# Oracle April 2026 Critical CPU — Pre/Post Patch Verification (Linux)
# Run as root or sudo. Output written to /var/log/oracle_cpu_audit_<date>.log

LOG="/var/log/oracle_cpu_audit_$(date +%Y%m%d).log"
exec > >(tee -a "$LOG") 2>&1

echo "=== [1] Listening Oracle-related services ==="
ss -tlnp | grep -E ':(1521|1522|2483|2484|7001|7002|8001|1159|7803|4443)\b'

echo "=== [2] TNS Listener version and status ==="
for ORA_HOME in $(ps -eo args | grep -oP '/\S*(?=/bin/tnslsnr)' | sort -u); do
  echo "-- Listener home: $ORA_HOME"
  sudo -u oracle "$ORA_HOME/bin/lsnrctl" status 2>/dev/null | grep -E 'Version|Alias|Listener'
done

echo "=== [3] Listener hardening checks ==="
LSNR=$(find /u01 /opt -name listener.ora 2>/dev/null | head -5)
for f in $LSNR; do
  echo "-- $f"
  grep -iE 'ADMIN_RESTRICTIONS|VALID_NODE_CHECKING|TCPS|WALLET' "$f" || echo "   WARNING: no admin restrictions / node checking found"
done

echo "=== [4] Oracle OPatch inventory (current patch level) ==="
for OH in $(ps -eo args | grep -oP '/\S*(?=/bin/(oracle|tnslsnr))' | sort -u); do
  echo "-- Oracle Home: $OH"
  sudo -u oracle "$OH/OPatch/opatch" lsinventory -oh "$OH" 2>/dev/null | grep -E 'Oracle Interim Patch|applied on|Unique Patch ID'
done

echo "=== [5] WebLogic patch inventory (Smart Update / BSU artifacts) ==="
find /u01 /opt -path '*oracle_common*' -name 'opatch' 2>/dev/null | head -3 | while read OP; do
  MW=$(dirname "$(dirname "$OP")")
  echo "-- Middleware home: $MW"
  "$OP" lsinventory -oh "$MW" 2>/dev/null | grep -E 'Patch|applied on' | head -10
done

echo "=== [6] Suspicious child processes of oracle/java (last snapshot) ==="
ps -eo pid,ppid,user,comm,args | awk 'NR==1 || ($4 ~ /oracle|tnslsnr|java/ && $5 ~ /sh|bash|curl|wget|nc|python/)'

echo "=== [7] Files modified in last 72h in temp/shared-memory dirs ==="
find /tmp /var/tmp /dev/shm -type f -mtime -3 -ls 2>/dev/null

echo "=== Audit complete. Re-run after CPU application and diff outputs. ==="

# Oracle April 2026 Critical CPU — Pre/Post Patch Verification (Windows)
# Run elevated on Oracle DB / WebLogic Windows hosts.

$Log = "C:\Windows\Temp\oracle_cpu_audit_$(Get-Date -Format yyyyMMdd).log"
Start-Transcript -Path $Log -Append

Write-Host "=== [1] Listening Oracle-related services ==="
Get-NetTCPConnection -State Listen | Where-Object {
    $_.LocalPort -in 1521,1522,2483,2484,7001,7002,8001,1159,7803,4443
} | Select-Object LocalAddress, LocalPort, OwningProcess,
    @{N='Process';E={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}} |
    Format-Table -AutoSize

Write-Host "=== [2] Oracle services and versions ==="
Get-CimInstance Win32_Service | Where-Object {
    $_.Name -match 'Oracle|TNS|WebLogic|NodeManager'
} | Select-Object Name, State, StartMode, PathName | Format-List

Write-Host "=== [3] Suspicious child processes under Oracle/WebLogic ==="
$OracleProcs = Get-CimInstance Win32_Process | Where-Object {
    $_.Name -match '^(oracle|tnslsnr|java|javaw)\.exe$'
}
foreach ($p in $OracleProcs) {
    Get-CimInstance Win32_Process | Where-Object {
        $_.ParentProcessId -eq $p.ProcessId -and
        $_.Name -match '^(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|certutil)\.exe$'
    } | Select-Object @{N='Parent';E={$p.Name}}, Name, ProcessId, CommandLine
}

Write-Host "=== [4] Recent executable drops in temp paths (last 72h) ==="
$cutoff = (Get-Date).AddHours(-72)
Get-ChildItem 'C:\Windows\Temp','C:\Users\*\AppData\Local\Temp' -Include *.exe,*.dll,*.ps1,*.bat -Recurse -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt $cutoff } |
    Select-Object FullName, LastWriteTime, Length

Write-Host "=== [5] Outbound connections from Oracle processes (non-standard ports) ==="
foreach ($p in $OracleProcs) {
    Get-NetTCPConnection -OwningProcess $p.ProcessId -State Established -ErrorAction SilentlyContinue |
        Where-Object { $_.RemotePort -notin 1521,1522,443,7001,7002 } |
        Select-Object @{N='Process';E={$p.Name}}, RemoteAddress, RemotePort
}

Stop-Transcript
Write-Host "Audit written to $Log — re-run after patching and compare."